docs: add SECURITY.md with vulnerability disclosure policy

[yachikadev]

Closes #620

What's changed

• Added SECURITY.md in the root of the repository

Why

DevCard handles user contact data and profile information but had no security disclosure policy. This is a GitHub best practice for any public repo handling personal data.

What's included

• Supported versions table
• Reporting channel via GitHub Private Security Advisory (keeps disclosure private by default)
• Response timeline (48hr acknowledgement, 7 day update, 30 day fix)
• In-scope vulnerabilities specific to DevCard's attack surface
• Out-of-scope items
• Responsible disclosure policy
• Acknowledgement policy for reporters

[vercel]

@yachikadev is attempting to deploy a commit to the Prashantkumar Khatri's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Hi @yachikadev,

Thanks for opening this pull request.

This PR has been automatically classified based on the files modified.

Applied Labels

• gssoc:approved

Primary Review Area

• null

Reviewer

null has been identified as the primary reviewer for this pull request.

If you have any questions regarding the affected area or implementation details, feel free to reach out to the assigned reviewer.

Thank you for your contribution!

[github-actions]

CI — All Checks Passed

Backend — SKIP

Check	Result
Lint	-
Test	-
Typecheck	-

Mobile — SKIP

Check	Result
Lint	-
Test	-

Web — SKIP

Check	Result
Build	-

---

Last updated: Thu, 02 Jul 2026 07:55:07 GMT

[github-actions]

Congratulations @yachikadev on getting PR #651 merged!

Thank you for your contribution to the project.

To receive the appropriate GSSoC labels and recognition, please mention @Harxhit in the #get-labels channel on our Discord server and share your merged PR link.